diff options
author | Stan Hu <stanhu@gmail.com> | 2017-12-06 10:23:59 +0300 |
---|---|---|
committer | Stan Hu <stanhu@gmail.com> | 2017-12-13 02:07:24 +0300 |
commit | bc2d32aca0be46250bd02c9312d1064df024b621 (patch) | |
tree | 606015ccb2deb339f10db6830c052f210718a384 /app/policies/ci | |
parent | f6966cfa63fab7e3c8847d69101c6c6a444fb85f (diff) |
Create a play_pipeline_schedule policy and use it
Diffstat (limited to 'app/policies/ci')
-rw-r--r-- | app/policies/ci/pipeline_schedule_policy.rb | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/app/policies/ci/pipeline_schedule_policy.rb b/app/policies/ci/pipeline_schedule_policy.rb index 6b7598e1821..8e7e129f135 100644 --- a/app/policies/ci/pipeline_schedule_policy.rb +++ b/app/policies/ci/pipeline_schedule_policy.rb @@ -2,13 +2,31 @@ module Ci class PipelineSchedulePolicy < PipelinePolicy alias_method :pipeline_schedule, :subject + condition(:protected_ref) do + access = ::Gitlab::UserAccess.new(@user, project: @subject.project) + + if @subject.project.repository.branch_exists?(@subject.ref) + access.can_update_branch?(@subject.ref) + elsif @subject.project.repository.tag_exists?(@subject.ref) + access.can_create_tag?(@subject.ref) + else + true + end + end + condition(:owner_of_schedule) do can?(:developer_access) && pipeline_schedule.owned_by?(@user) end + rule { can?(:developer_access) }.policy do + enable :play_pipeline_schedule + end + rule { can?(:master_access) | owner_of_schedule }.policy do enable :update_pipeline_schedule enable :admin_pipeline_schedule end + + rule { protected_ref }.prevent :play_pipeline_schedule end end |